Which States Now Regulate AI in Therapy, and What Each One Asks of You

If you practice in more than one state, or you are simply trying to work out whether your note tool is still legal where you live, the news coverage has not helped much. Four states have passed laws about AI in mental health care since March 2025, and most summaries treat them as one trend with one rule. They are not one rule. One of them changes how you write notes. Two of them are mostly aimed at chatbot companies and may never touch your practice at all.

This is a read of what each statute actually says, with the operative text quoted so you can check it yourself. It is clinician education, not legal advice. Confirm anything that affects your practice with a lawyer licensed where you work.

The short version

Rhode Island passed an AI package in 2026 as well. We have left it out of this piece rather than summarize it from secondary coverage, and will add it once we have read the enacted text. More states have bills moving.

One note on the Maine row. April 13, 2026 is the date the Governor approved the bill, which is not automatically the date it takes effect. Maine non-emergency legislation follows the state's standard commencement rule rather than starting on signature, and the enacted text we read carries no separate effective-date clause. If you practice in Maine, confirm the operative date with the Board rather than assuming either signature day or a fixed offset.

Illinois went first, and it is narrower than the headlines

Illinois passed the first state law in the country regulating AI in the delivery of therapy. Governor Pritzker signed it on August 4, 2025, and the state's own regulator, the Department of Financial and Professional Regulation, put out the announcement the same day.

IDFPR describes the Act plainly. It "prohibits anyone from using AI to provide mental health and therapeutic decision-making, while allowing the use of AI for administrative and supplementary support services for licensed behavioral health professionals" (IDFPR, August 4, 2025).

Two things follow from that sentence, and both matter more than the "Illinois bans AI therapy" headline.

The first is that documentation work is on the permitted side of the line. The Act is aimed at AI acting as the therapist, not AI helping the therapist write up what happened.

The second is what the announcement does not say. It sets out no separate requirement to obtain consent to record a session. A number of compliance blogs have listed Illinois alongside states that require recording consent for AI. That grouping does not match how the state regulator describes its own law. If you have been told Illinois requires you to collect recording consent before using an AI note tool, ask where in the Act that appears.

Enforcement is real but modest. IDFPR investigates suspected violations, and "all confirmed violations will result in a fine of up to $10,000." The Act passed unanimously in both chambers and took effect immediately on signature.

Maine is the one that changes your consent form

Maine's law is the one to read closely. LD 2082 was approved by the Governor on April 13, 2026 and became Public Law Chapter 687. It does two separate things in two separate places.

Section 1 adds 10 MRSA section 1500-EE, which bars offering therapy to the public through internet-based AI unless a licensed professional provides it. A violation is a violation of the Maine Unfair Trade Practices Act. There is a narrow carve-out for AI used solely inside IRB-approved research.

Section 2 is the part that reaches into your practice. It adds 32 MRSA section 2113, which splits permitted AI use into two categories.

Administrative support covers "tasks performed to assist a licensed professional in the delivery of therapy or psychotherapy services that do not involve therapeutic communication," and the statute lists appointment scheduling and reminders, billing and insurance claims, and drafting logistical communications. Nothing extra attaches to these.

Supplementary support is the category your note tool falls into. The statute defines it as tasks that involve neither therapeutic communication nor administrative support, and the first example it gives is "preparing and maintaining client records, including therapy notes."

Here is the condition, quoted in full from section 2113(3):

A licensee may use artificial intelligence to assist in providing supplementary support in therapy or psychotherapy services only when the client's therapeutic session is recorded or transcribed, and only if:

A. The client or the client's legally authorized representative is informed in writing of the following:
(1) That artificial intelligence will be used;
(2) The specific purpose of the artificial intelligence tool or system that will be used; and
(3) How session data collected by artificial intelligence will be stored, retained, used for training and deleted upon termination of therapy or psychotherapy services; and

B. The client or the client's legally authorized representative provides consent to the use of artificial intelligence.

Read that first clause twice, because it is doing something unusual. On its plain wording, the permission to use AI for supplementary support is conditioned on the session being recorded or transcribed. That is close to the opposite of what most people assume a privacy statute would say, and it raises a live question for anyone whose AI drafts from typed notes rather than audio: is such a tool outside the section entirely, or outside the permission it grants? The text does not resolve it. This is a question for a Maine-licensed attorney, and if you practice there it is worth asking now rather than after an inspection.

Three more provisions are worth knowing.

The definition of consent is strict. It has to be "a clear, explicit and affirmative act" that is "express, informed, voluntary, specific and unambiguous," in writing, and revocable. The statute then rules out three things that do not count: acceptance of "a general or broad terms-of-use agreement," a client "hovering over, muting, pausing or closing" content, and any agreement "obtained through the use of deceptive actions." Burying AI consent in your standard intake packet will not satisfy this. The Act does allow consent by initialing a specific section of a general consent to treatment agreement, which is the practical route most practices will take.

You cannot make AI a condition of care. Section 2113(5) reads: "A licensee may not deny, or refuse to provide, therapy or psychotherapy services to a client on the sole basis that the client has not provided consent to the use of artificial intelligence to assist in providing supplementary support." If a client says no, you still see them, and you still have to produce a note.

The clinician stays responsible. Section 2113(2)(A) requires the licensee to maintain "full responsibility for all interactions, outputs and data use associated with the use of artificial intelligence," and section 2113(4) bars AI from making independent therapeutic decisions, interacting with clients in therapeutic communication, or generating recommendations or treatment plans without the licensee's review and approval.

You cannot paper over any of it. Subsection 11 is titled "Client waiver void and unenforceable" and reads: "Any waiver by a client of the provisions of this section is contrary to public policy and is void and unenforceable." A consent form that asks clients to sign away these protections does nothing.

And clients can sue. Subsection 12 preserves a client's right to bring an action "for harm caused to a client that is attributable to the use of artificial intelligence," an action for professional negligence, or any other remedy available under other law. The board is also directed to adopt implementing rules, so the detail here is likely to grow.

One practical note on finding your own rules. The Act does not put these requirements in a single place. Section 2 enacts 32 MRSA section 2113 and section 3 enacts 32 MRSA section 2600-G with materially the same requirements for a different set of licensing chapters. The text quoted here is from section 2113. If you hold a different Maine license, read the section that governs your chapter rather than assuming this one applies to you word for word.

Nevada and Utah are aimed somewhere else

These two are worth knowing about, and worth not panicking about.

Nevada's AB 406 was signed in June 2025 and took effect on July 1, 2025. It prohibits offering interactive AI systems that provide, or claim to provide, professional mental or behavioral health care, and it restricts AI in school counseling roles (Lexology).

Utah's HB 452 was signed on March 25, 2025 and took effect May 7, 2025. It regulates "mental health chatbots" reachable by any user located in Utah, and its main obligations are disclosure ones: tell users they are talking to software before first use, again after a seven-day gap, and whenever asked. It restricts advertising inside the chatbot and bars selling individually identifiable health information without consent. It also offers a safe harbor for suppliers who run a documented compliance program (Wilson Sonsini).

Neither of these targets a licensed clinician using software to draft a progress note. If your practice has no consumer-facing chatbot, they are context rather than compliance work.

What to actually do about it

Start with a question your vendor should be able to answer in one sentence: does the tool record or transcribe the session?

That single fact decides most of your exposure. Recording pulls in state wiretapping and eavesdropping law, which is older and broader than any of these AI statutes, and roughly a dozen states require all parties to agree. It is also the fact Maine's section 2113(3) turns on.

From there:

1. Find out where your clients are sitting, not where you are. These statutes reach the client's location. A Maine client on a telehealth call brings Maine's rules with them.
2. Get AI consent out of the terms-of-use. Maine explicitly refuses to count that. A separately initialed section in your consent to treatment does count.
3. Write down the data answers before a client asks. Maine requires you to state in writing how session data is stored, retained, used for training, and deleted at the end of care. If your vendor cannot give you those four answers, you cannot make that disclosure truthfully.
4. Build a workflow that survives a no. You cannot refuse care over AI consent in Maine, so you need a documentation path with AI switched off.
5. Keep a licensed human signing everything. Every one of these laws draws its hardest line at AI substituting for clinical judgment.

Where CoralEHR sits

We think the recording question is the one worth designing around, so our AI documentation does not record sessions. A clinician types a scratchpad, the AI turns that plus structured chart fields into a draft, and the clinician edits and signs it. There is no microphone and no transcript. We have written separately about why we do not require recording your sessions and about how to disclose AI documentation to clients.

That design removes the wiretapping question. It does not remove your disclosure obligations, and as the Maine text shows, it may raise its own questions in a state that wrote its rule around recorded sessions. Statutes here are moving quickly. Check the current text before you rely on any summary, including this one.

Sources: IDFPR announcement on HB 1806 (August 4, 2025) · Maine LD 2082 / Public Law Ch. 687, enacted text · Wilson Sonsini on Utah HB 452 · Lexology on Nevada AB 406

Statutory text quoted above was read from the enacted bill documents linked here on September 19, 2026.